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SECTION  I 
INTRODUCTION 

Since  the  early  fifties  there  has  been  one  continuous  requirement  about 
space  power:  Larger  and  larger  amounts  of  reliable,  long  lived  electrical 
power  has  been  needed.  It  has  been  equally  clear  that  to  supply  this  large 
quantity  of  electrical  power  only  solar  or  nuclear  systems  will  suffice;  the 
weight  associated  with  the  various  chemical  systems  becomes  prohibitive. 

Figure  1,  taken  from  the  DOD/AEC  Space  Pov/er  Study  (ref.  1),  shows  the  solar 
and  nuclear  space  electric  power  history  from  1960  to  the  present.  For  students 
of  the  history  of  space  power  and  space  missions,  this  study  provides  an 
excellent,  comprehensive  overview  of  the  area. 

Now,  It  Is  not  the  purpose  of  this  study  to  argue  the  merits  of  solar  power 
versus  nuclear  power  or  to  delineate  the  advantages  of  one  over  the  other. 
However,  there  are  missions  where  nuclear  power  Is  required- -deep  space  launches, 
missions  where  elements  of  concealment  or  ability  to  function  In  anomalous 
environments  Is  Important,  come  to  mind.  It  Is  this  type  of  mission  with  which 
we  are  concerned. 

In  the  mid-1960s  when  It  became  Increasingly  evident  that  the  amount  of 
nuclear  material  needed  to  generate  the  electrical  power  would  be  nontrivial— 
the  Marl ner-Jupl ter  Saturn  (MJS)  mission  will  Involve  the  launching  of  over 
220,000  curies  of  PU^^®— It  was  realized  that  a thorough  systematic  review  of 
all  space  nuclear  power  launches  would  be  needed.  Safety  aspects  and  environ- 
mental considerations  are  of  major  Importance;  the  structures  of  national 
policy,  test  ban  treaties  for  Instance,  must  be  considered.  The  National 
Security  Action  Memorandum  No.  50,  1965  (NASM  50),  revised.  Indicated  that  the 
concept  of  launching  space  nuclear  power  missions  was  receiving  consideration 
at  the  highest  level.  As  a result,  the  Interagency  Nuclear  Safety  Review  Panel 
(INSRP)  was  formed  with  the  charter  and  direction  to  thoroughly  review  all 


1.  DOD/AEC  Space  Power  Study,  DOD/AEC  AD  HOC  Study  Group  on  Space  Power, 
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United  States  (US)  space  nuclear  power  launches  and  to  prepare  a formal  Safety 
Evaluation  Report  (SER)  which  would  be  staffed  through  the  National  Security 
Council  of  the  President.  Presidential  approval  of  the  launch,  or  lack  thereof, 
would  then  be  based  on  this  safety  evaluation,  as  well  as  the  constraints  of 
national  security. 

The  members,  or  coordinators  as  they  are  called,  are:  One  each  from  the 
Energy  Research  & Development  Administration  (ERDA),  NASA,  and  the  DOD  with  their 
respective  supporting  staffs.  Traditionally,  the  ERDA  coordinator  has  been 
named  from  the  Division  of  Space  Nuclear  Systems  (SNS)  now  the  Division  of 
Nuclear  Research  and  Applications  (NRA);  the  NASA  coordinator  from  the  Office  of 
Center  Operations,  and  the  DOD  coordinator,  selected  by  the  Deputy  Secretary  of 
Defense,  from  the  Directorate  of  Nuclear  Surety  (DNS).  The  Air  Force  Weapons 
Laboratory  (AFWL),  persuant  to  AFR  122-15  and  16,  functions  as  the  technical 
support  team  to  the  DOD  coordinator  on  the  INSRP.  It  Is  thus  that  the  AFWL 
became  Intimately  Involved  In  the  nuclear  safety  review  process  for  all  US  space 
nuclear  launches,  even  the  NASA  space  explorations.  It  Is  this  support  and  the 
methodology  Involved  which  Is  the  subject  of  this  technical  report. 

Section  II  contains  a discussion  of  the  Independent  safety  analysis  pro- 
vided by  the  AFWL  In  support  of  the  DOD  coordinator.  Mathematical  models  are 
emphasized  and  analysis  techniques  are  described.  Accident  environment  modeling 
Is  covered  In  section  III.  Launch  pad  abort  and  reentry  situations  are  high- 
lighted; special  attention  Is  given  to  the  relation  between  theory  and  experi- 
ment. The  limitations  of  the  safety  analyses  testing,  to  date,  are  also  dis- 
cussed. 

In  section  IV,  a summary  of  the  Independent  AFWL  nuclear  review  of  the 
Lincoln  Experimental  Satellites  8 and  9 (LES  8/9)  is  given.  Excerpts  from  the 
accident  sequence  trees  for  this  mission  and  probability  summary  tables  for  the 
launch  phases  are  presented.  Section  V presents  a brief  overview  of  the  role 
the  Environmental  Statement,  required  by  the  National  Environmental  Policy  Act 
(NEPA)  of  1969  and  AFR  19-2,  plays  In  the  safety  review  process  for  these 
mission  types.  Finally,  Included  as  an  appendix  are  the  complete  accident 
sequence  trees,  with  probability  numbers,  generated  during  the  safety  review  of 
the  LES  8/9  mission. 
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SECTION  II 

INDEPENDENT  ANALYSES 

The  AFWL  provides  an  independent  safety  evaluation  of  each  space  nuclear 
system  as  well  as  continuous  evaluation  of  the  power  source  contractor's  safety 
analysis  report.  Each  of  the  other  responsible  agencies  performs  its  own  in- 
dependent analyses  and  evaluations;  however,  only  the  AFWL  analyses  and  system- 
contractor  safety  analysis  techniques  are  discussed. 

Several  different  basic  analysis  tools  have  been  used  to  prepare  representa- 
tive risk  assessments  on  the  power  sources— most  often  Radioisotopic  Thermo- 
electric Generators  (RTG)— prior  to  launch.  These  analyses  must  be  compre- 
hensive enough  to  give  realistic  probabilities  for  launch  pad  and  reentry 
anomalies  plus  the  consequences  associated  with  any  credible  accident.  Due  to 
the  vastly  different  natures  of  the  series  of  environments  the  RTG  fuel  contain- 
ment must  withstand,  the  analysis  used  must  be  capable  of  adequately  treating 
sequential  events  (e.g.,  fuel  sphere  assembly  impact  at  velocities  in  excess  of 
2DD  fps  with  or  without  reentry  heating  and  thermal  stress).  The  basic  safety 
analysis  utilizes  one  of  the  following: 

(1)  Matrix  descriptions  showing  basic  system  state  transitions  caused 
by  accidents  (used  for  Pioneers  F and  G). 

(2)  A modified  Monte  Carlo  analysis  which  generates  accident  prob- 
abilities from  Failure  Modes  and  Effects  (FMEA)  data,  a basic  sequence  tree,  and 
accident  environment  failure  threshold. 

(3)  Fault  Trees  (accident  sequence  trees)  showing  detailed  accident 
sequencing  with  nominal  accident  consequences  (LES  8/9  and  MJS). 

Each  of  these  techniques  requires  either  separate  treatment  of  system 
response  (i.e.,  fuel  releases)  or  separate  treatments  of  launch  pad  and/or 
reentry  accidents.  To  date  the  only  solid  documented  data  base  available  to  the 
safety  analysis  contractors  is  the  Dverall  Safety  Manual  (ref.  2),  which  was 
initiated  by  ERDA  and  prepared  by  NUS  Corporation.  This  four  volume  document 

2.  The  Dverall  Safety  Manual  (GSM),  USAEC  (SNS),  prepared  by  NUS  Corporation, 

Rockville,  MD.,  June  1974. 
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provides  a sound  basis  for  the  preparation  of  a safety  analysis  report  and 
exceptional  detail  on  the  biological  dose  paths*  Inhalation  codes*  and  ultimate 
consequences.  However*  the  basic  approach  to  generating  source  terms:  1.e., 
fuel  releases  associated  with  specific  missile  and  radioisotopic  heat  source 
accidents  and  responses*  Is  left  to  the  innovative  devices  of  the  civilian  con- 
tractor and  the  technical  analysts  for  the  reviewing  agencies.  The  remaining 
discussion  highlights  the  transition  matrix  and  the  modified  Monte  Carlo  tech- 
niques and  specifically  discusses  the  AFWL  event  tree  analysis  prepared  for 
LES  8/9.  The  typical  event  tree  technique  shows  the  complexities  of  sequential 
environments  that  must*  in  some  unified  manner,  be  analyzed. 

1.  TRANSITION  STATE  MATRIX  ANALYSIS 

To  date  this  technique,  as  well  as  the  others  discussed,  depends  heavily  on 
the  missile  FMEA  data.  This  type  of  data  is  prepared  by  the  missile  contractors 
to  show  failure  probabilities  based  on  component  failure  data.  Therefore*  to  be 
used  in  risk  assessment,  these  data  must  be  translated  into  realistic  accidents 
in  the  launch  sequence  and  related  to  the  ultimate  environments  created  in  an 
accident.  Models  for  accident  environments  and  RTG  responses  are  developed  in 
the  RTG  Safety  Analysis  Report  (SAR)  provided  by  the  RTG  contractor.  The  tran- 
sition matrix  technique  was  used  in  conjunction  with  event  tree  analysis  for  the 
Pioneers  F and  G,  SNAP  19*  safety  evaluation  (refs.  3 through  5).  In  this 
method  the  heat  source  and  its  Internal  modular  components  were  represented  by  a 
state  vector  defining  the  probability  that  the  heat  source  is  in  a particular 
discrete  state  (e.g.,  heat  source  intact*  internal  fuel  spheres  intact  but  free, 
or  fully  released)  (ref . 4).  The  consequences  of  any  environment  were  nominally 
represented  by  a new  state  vector  characterizing  the  changed  state  of  the  heat 
source. 


3.  SNAP  19/Pioneer  F Safety  Analysis  Report.  Teledyne  Isotopes*  INSD-2873-42* 
Timonium*  MD,  June  1971. 

4.  Nuclear  Safety  Analysis  Methodologies  for  RTG  Equipped  Satellite  Launches. 
MDAC*  AFWL-TR-^6-166*  A^r  Force  Weapons  Laboratory,  Kirtl and  AFB,  NM,  1976. 

5.  Methodology  Study  for  Preorbital  Aborts,  Teledyne  Energy  Systems, 
AFWL-TR-^^223  (Revised),  Air  Force  Weapons  Laboratory,  Kirtl  and  AFB,  NM, 
1976. 
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where 


where 


k = State  Vector 


p k s Probability  of  being  in  state  j before  environment  k 
M. = Probability  of  transition  from  stage  j'  to  state  j during 

J J 4 - 

environment  1 (elements  of  matrix  M ) 

Sequential  accidents  leading  to  a final  state  are  treated  as  follows: 


S 


I+l 


TT 

i=l,l 


S 


i 


In  theory,  this  technique  is  an  adequate  way  of  characterizing  the  sequential 
accident  environments  and  responses;  however,  in  practice  with  sequential 
environments,  the  matrices  become  unwieldy  with  elements  described  by  prob- 
ability distributions.  However,  the  method,  when  combined  with  event  tree 
analysis,  proved  an  effective  tool  for  describing  discrete  system  and  environ- 
ment transitions. 

2.  LAUNCH  PAD  MONTE  CARLO  ANALYSIS 

This  analysis  tool  was  effectively  utilized  for  the  Vikings  A and  B analysis 
which  again  utilized  the  SNAP  19  RTG.  The  results  of  this  technique  are  published 
in  reference  6.  The  method  is  described  in  somewhat  more  detail  here  than  is 
available  in  the  literature.  The  Monte  Carlo  technique  was  used  as  a simulation 
process  to  compute  10,000  histories  developed  through  an  event/consequence  flow 
chart  describing  the  accident  process  (fig.  2).  In  each  history  the  radio- 
isotopic heat  source  unit  is  exposed  to  a sequence  of  environments  with  asso- 
ciated system  response  probabilities.  The  Monte  Carlo  simulation  was  also  used 
to  calculate  the  convolution  integrals  describing  interfacing  distributional 
events  in  system  state  transitions.  This  allows  the  new  system  state  to  be 

6.  SNAP  19/Vikinq  '75  Final  Safety  Analysis  Report,  Teledyne  Energy  Systems, 

ESD-3069-15,  Timonium,  MD.,  August  1974. 


6 


AFVlL-TR-77-104 


NOS.  1-4,  6 


pick:  accident  time  , 
PRESSURE 


BLAST  INDUCED 
TRANSITIONS-FINAL  STATE. 
SOURCE  TERM 


CALCULATE:  IMPACT  SPEED. 
LOCATION.  FLIGHT  TIME 
TARGET 


CALCULATE:  FIREBALL 
TRANSITIONS.  IMPACT 
TEMPERATURE 


IMPACT  TRANSITIONS 
SOURCE  TERM 


SOLID  PROPELLANT  EXPOSURE 
BURNTIME,  SOURCE  TERM 


FINAL  STATE 


SELECT  ACCIDENT 


r 

NO.  5 1 

1 

c 

TAIL.  FLAT 


ACCIDENT  TIME.  IMPACT 
SPEED  TARGET 


IMPACT  TRANSITIONS 
SOURCE  TERM 


FIREBALL 

TRANSITIONS 


FINAL  STATE 


CUMULATIVE: 

INTERNAL 

f RESPIRABLE  FINES 

V SUPERRESPIRABLE  FINES 

RELEASED 

f RESPIRABLE  FINES 

SUPERRESPIRABLE  FINES 

Figure  2.  Launch  Pad  Monte  Carlo  Flow  Diagram 
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determined  after  exposure  to  each  sequential  environment.  The  states  referred 
to  are  not  necessarily  actual  containment  breaches  but  may  include  estimates 
of  the  system  degradation  prior  to  accident  causing  breach.  The  actual  failure 
events  derived  from  FMEA  data  were  treated  as  discrete  happenings  which  occurred 
as  a random  selection  process  that  picks  accident  times  from  a uniform  dis- 
tribution. Based  on  the  selected  accident  time,  the  other  environmental  param- 
eters were  determined  from  the  existing  state  of  the  vehicle  and  the  distri- 
butionally  described  accident  environments  and  system  responses.  Wherever 
possible  the  probability  characterization  functions  used  in  these  models  were 
derived  from  physical  data;  however,  by  necessity,  many  parameters  were  de- 
rived from  theoretical  analysis  and  engineering  judgment.  The  accumulated 
results,  after  a number  of  histories,  provided  probabilistic  answers  to  the 
question  of  fuel  release,  both  if  and  how  much. 

This  technique  and  the  others  rely  heavily  on  the  quality  of  FMEA  data  and 
the  current  sophistication  of  enviornmental  modeling.  The  ERDA  and  the  AFWL 
continue  to  sponsor  data  improvement  programs  to  increase  the  quality  of  future 
safety  evaluations. 
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SECTION  III 

ACCIDENT  ENVIRONMENT  MODELING 

The  consequences  of  accidents  Involving  RTG  are  determined  by  the  estimated 
response  of  the  radioactive  fuel  containment  to  the  accident  environment  (blast. 
Impact,  liquid  propellant  fires,  solid  propellant  fires,  and  reentry)  or  combi- 
nation of  environments.  To  help  characterize  the  response,  data  on  the  environ- 
ments must  be  accumulated.  To  date,  emphasis  has  been  placed  on  simulating 
defined  "worst  case"  accidents  and  evaluating  the  system  response  on  a pass/fall 
basis.  The  safety  analysis  process  then  applied  the  responses  to  various  acci- 
dent scenarios  deemed  "probable"  to  determine  possible  fuel  release  situations. 

Tests  that  have  been  conducted  have  attempted  to  Investigate  the  surviv- 
ability of  the  Multihundred  Watt  (MHW)  Heat  Source  Assembly  (HSA)  and/or  Its 
components  In  the  event  of  catastrophic  accidents.  The  MHW  was  used  In  the 
Voyager  and  LES  8/9  missions.  These  accidents  are  basically  divided  Into  two 
areas  of  concern— launch  pad  accidents  and  unplanned  reentry. 

1 . LAUNCH  PAD  ABORT  ENVIRONMENTS  TESTS 

Accident  environments  that  would  characterize  launch  pad  accidents  Include 
blast.  Impact,  liquid  propellant  fires,  and  solid  propellant  fires.  Including 
sequential  exposure.  The  blast  environment  (S-1)  safety  test  was  performed  to 
determine  the  survivability  of  MHW  Fuel  Sphere  Assemblies  (ESA)  In  the  blast 
environment  created  by  the  explosion  In  the  Titan  transtage  propellant  tanks. 

This  explosion  was  simulated  by  placing  a group  of  FSAs  In  a shock  tube  and 
subjecting  them  to  a shock  wave  with  the  following  characteristics:  (a)  peak 
static  overpressure  of  57  psi ; (b)  a peak  stagnation  overpressure  of  133  psi; 

(c)  a static  Impulse  of  1.31  psi-sec;  and  (d)  a stagnation  Impulse  of  3.2  psi-sec. 
This  shock  wave  simulated  those  overpressures  that  would  occur  for  a 5 percent 
TNT  equivalent  yield  of  the  transtage,  which  was  determined  to  be  more  than  10 
times  the  yield  expected  In  the  vast  majority  of  Titan  aborts.  The  fuel  con- 
tainments (Post  Impact  Containment  Shell;  PICS)  were  not  breached  and  evidenced 
very  little  damage  as  a result  of  these  tests  (ref.  7). 

7.  General  Electric  Co.,  Space  Division,  Philadelphia,  PA,  Safety  Test  No.  S-1, 
Explosion,  GEMS-410,  April  20,  1973. 
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The  liquid  propellant  fire  (S-2)  safety  test  exposed  two  FSAs  and  two  Post 
Impact  Sphere  Assemblies  (PISA)  to  a liquid  propellant  residual  fire.  This  was 
simulated  by  placing  the  specimens  in  a shallow  pond  of  Aerozine  50  (the  liquid 
fuel  of  Titan)  after  being  preheated  to  the  MHW-RTG  operating  temperature  of 
1090°C.  The  propellant  was  ignited  and  burned  for  a period  of  20  minutes  at 
temperatures  ranging  from  820°  to  930°C.  Post  test  examination  revealed  that 
the  specimens  showed  only  minor  degradation  and  discoloring  with  no  breaching 
or  apparent  damage  (ref.  8). 

The  solid  propellant  fire  (S-3)  tests  were  designed  to  expose  both  FSAs  and 
PISAs  to  the  severe  thermochemical  environment  resulting  from  solid  propellant 
(UTP-3001  for  Titan)  combustion.  Specimens  were  placed  directly  on  top  of 
(contact  test)  and  between  two  (double  proximity)  pieces  of  solid  propellant. 

Both  tests  utilized  cubes  91  cm  on  a side  to  simulate  the  maximum  expected  frag- 
ment resulting  from  breakup  of  a Solid  Rocket  Motor  (SRM).  Of  the  specimens 
exposed  to  the  contact  fire  one  PICS  evidenced  minor,  localized  melting  on  the 

surface.  Three  of  the  four  specimens  exposed  to  the  double  proximity  fire  evi- 

2 

denced  containment  failure.  The  breaches  were  approximately  1.6  cm  and  were 
due,  not  to  simple  melting,  but  to  various  complex  high  temperature  reactions 
of  the  PICS  and  Graphite  Impact  Shell  (GIS  - the  outer  carbon  material  of  the 
FSA)  with  materials  such  as  iron  and  sand  which  were  in  the  test  environment 
(ref.  9). 

Launch  pad  abort  sequential  (S-6)  safety  tests  were  also  conducted  to  de- 
termine the  response  of  MHW  components  to  a series  of  likely  accident  environ- 
ments. The  tests  were  conducted  in  three  phases:  Phase  I involved  a full  HSA 
impact  at  a velocity  typical  of  a launch  pad  or  early  ascent  accident;  Phase  II 
consisted  of  additional  solid  propellant  fire  exposure  tests;  and  Phase  III  in- 
cluded a variety  of  FSA  impact  tests.  A preheated  HSA  was  impacted  on  a concrete 
target  at  a velocity  of  30  meters/sec  for  the  Phase  I test,  simulating  free-fall 
of  an  HSA  from  heights  consistent  with  launch  sequences.  The  HSA  was  not  fully 
heated  prior  to  the  test  which  would  result  in  the  irridium  PICS  being  more 


8.  General  Electric  Co.,  Space  Division,  Philadelphia,  PA.,  Safety  Test  No.  S-2, 
Propellant  Fire  Thermochemical  Effects.  GEMS-413,  July  197TI 

9.  General  Electric  Co.,  Space  Division,  Philadelphia,  PA.,  Safety  Test  No.  S-3, 
Solid  Propellant  Fire.  GEMS-414,  July  1973. 
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brittle  than  expected.  As  a result  of  the  test,  the  HSA  broke  upon  Impact. 

None  of  the  GISs  were  seriously  damaged;  however,  several  of  the  PICS  within 
GHSs  were  cracked.  Phase  II  of  the  S-6  test  exposed  two  FSAs  (one  of  which  con- 
tained a cracked  PICS  from  the  Phase  I test)  and  a partial  HSA  to  a single  prox- 
imity solid  propellant  fire  In  which  the  specimens  were  placed  next  to  a 91  cm 
cube  of  solid  propellant.  No  significant  damage  to  the  PICS  was  observed;  how- 
ever, there  was  some  reaction  of  the  carbon  GIS,  and  molten  steel  formed  from 
melting  of  a steel  plate  purposely  Introduced  as  part  of  the  test  environment 
(ref.  10). 

The  Phase  III  tests  consisted  of  five  FSA  Impact  tests;  three  at  velocities 
comparable  to  launch  pad  type  velocities  (30  m/s)  and  two  at  reentry  velocities 
(85  m/s).  These  Impacts  Included  targets  of  angle  Iron,  concrete  and  soil. 
Although  the  preheated  PICS  were  severely  deformed  following  Impact  against 
angle  Iron  and  high  velocity  Impacts  on  concrete,  no  breaching  occurred.  A 
later  FSA  Impact  at  terminal  reentry  velocity  did  result  In  PICS  breaching 
(ref  11). 

2.  REENTRY  ENVIRONMENT  TESTS 

In  addition  to  the  Impact  tests  conducted  as  part  of  the  S-6  Phase  III 
testing,  FSAs  were  Impacted  at  terminal  velocities  on  smooth  granite,  repre- 
senting a severe  Impact  condition  on  a hard  surface.  In  these  tests,  a sub- 
stantial number  of  the  specimens  tested  evidenced  containment  failure. 

The  MHW  aeroshell  (a  carbon  container  for  the  FSAs)  was  also  subjected  to 
reentry  Induced  aerodynamic  heating  and  ablation  In  a series  of  tests.  These 
tests  measured  the  mass  loss  and  heat  transfer  and  Indicated  that  the  aeroshell 
would  not  fall  due  to  reentry.  A question  remains,  however,  that  the  aeroshell 
might  fall  due  to  thermal  stress  rather  than  ablation  under  certain  severe, 
steep  angle  reentry  conditions. 

3.  TESTING  CONCLUSION  AND  LIMITATIONS 

The  testing  program  conducted  to  date  Indicates  that  breaching  of  the  PICS 

10.  Snow,  E.  C.,  Safety  Test  No_.  S-6.  Launch  Pad  Abort  Sequential  Test  Phase  I: 
Low  Velocity  HSA  Impact,  LASL  Report  LA-5705-MS,  Los  Alamos  Scientific 
Laboratory.  New  MexUo,  August  1974. 

11.  Snow,  E.  C.,  and  Frantz,  C.  E.,  Safety  Test  No.  S-6.  Launch  Pad  Abort 
Sequential  Test  Phase  III;  FSA  Impacts.  LASL  Report  LA-5855-MS,  Los  Alamos 
Scientific  Laboratory,  New  Mexico,  January  1975. 
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is  not  likely  for  the  blast  environment,  liquid  propellant  fires,  contact  or 
single  proximity  fires,  free  FSA  or  HSA  impact  at  low  velocities  on  soil,  or 
reentry  heating.  Breaching  can  occur  in  environments  simulated  by  the  double 
proximity  solid  propellant  fires  or  upon  terminal  reentry  velocity  impacts  upon 
concrete  or  granite. 

A recognized  limitation  of  many  of  the  safety  tests  performed  to  date, 
largely  due  to  the  high  costs  of  such  tests,  is  that  each  test  often  represents 
only  a single  datum  point  with  the  results  presented  only  on  a pass/fail  basis. 
Test  conditions  are  often  based  only  on  the  nominal,  most  probable,  or  expected 
environment  rather  than  the  possible  ranges  of  environments.  Extrapolation  of 
the  data  available  from  the  tests  to  the  wide  range  of  possible  environments  is 
difficult  if  not  impossible;  and  uncertainties  remain  as  to  RTG  response  to 
environments  in  which  it  has  not  been  specifically  tested,  but  to  which  it  may 
be  exposed,  even  if  the  probabilities  of  such  exposure  are  small. 

The  AFWL  has  attempted  to  bridge  this  gap  between  available  data  and  the 
range  of  possible  environments  by  developing  analytical  tools  which  can  be 
utilized  at  a low  cost  for  specific  analyses.  These  analytical  tools  must,  how- 
ever, be  based  on  and  be  consistent  with  current  data.  Increased  credibility 
will  be  gained  by  using  simple  tests  to  verify  computer  models  prior  to  applying 
the  models  to  more  complex  systems. 

4.  SOLID  PROPELLANT  FIRE  ENVIRONMENT 

One  program  which  the  AFWL  is  pursuing  vigorously  is  an  attempt  to  more 
accurately  define  the  Solid  Propellant  Fire  Environment  (SPFE).  Although  a sub- 
stantial amount  of  information  has  been  generated  on  this  environment  during  the 
course  of  rocket  motor  development,  it  is  not  directly  applicable  to  safety 
analyses  because  it  is  based  on  combustion  of  the  propellant  at  the  high  pressure 
(1000  psi)  inside  the  rocket  motor,  rather  than  at  atmospheric  pressure,  which 
would  be  the  case  in  the  event  of  a catastrophic  accident.  The  nature  of  the 
complex,  two  phase  reacting  flow  of  the  combustion  region  illustrated  in  figure 
3,  inherently  restricts  our  ability  to  make  deterministic  measurements.  This 
severe  thermochemical  environment  is  known  to  be  capable  of  causing  containment 
failure.  Specific  failure  mechanisms  have,  however,  not  been  clearly  identified. 
To  this  end,  the  AFWL  and  the  Georgia  Institute  of  Technology  are  attempting  to 
measure  temperatures  in  the  flame,  to  identify  chemical  reactions  of  importance 
in  the  combustion  region,  to  determine  the  effects  of  air  admixture,  and  to 
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I 

1 

qualitatively  and  quantitatively  assess  the  interaction  of  the  SPFE  with  test 

objects  of  interest.  An  understanding  of  these  basic  parameters  of  the  SPFE  will  I 

provide  a technical  basis  for  defining  possible  containment  failure  mechanisms. 

In  particular,  the  AFWL  has  prepared  a theoretical  thermochemical  analysis 
of  the  SPFE  which  investigates  the  effects  of  incomplete  aluminum  combustion 
and  the  effects  of  air  addition  to  the  flame.  In  severe  environments  such  as 
the  SPFE,  analytical  calculations  are  known  often  to  present  a more  accurate 
picture  than  can  be  measured,  due  to  the  perturbations  caused  by  the  measuring 
apparatus  and  the  severe  effects  of  the  environment  on  the  apparatus. 

The  amount  of  aluminum  combustion  is  critical  because  it  is  the  fuel  and  j 

produces  the  intense  heat  generated  in  the  SPFE  (aluminum  burns  at  3S00®K)  (refs.  j 

12,  13).  Significant  quantities  of  unreacted  aluminum  metal  have  been  noted 
after  SPFE  tests  at  Teledyne  Energy  Systems  and  Sandia  Laboratory  (refs.  14,  15), 
which  may  indicate  lower  than  previously  calculated  adiabatic  flame  temperatures. 

Equilibrium  calculations  confirm  this  theory,  as  adiabatic  flame  temperatures 
decrease  from  2900°K  for  a complete  aluminum  combustion  to  approximately  2750°K 
for  40  percent  aluminum  combustion  and  2550°K  for  no  aluminum  combustion. 

Adiabatic  temperatures  remain  constant  or  increase  slightly  for  air  admixtures 
of  up  to  30  percent  by  weight,  but  begin  to  decrease  significantly  for  air  addi- 
tions greater  than  50  percent.  These  effects  are  a combination  of  further  oxi- 
dation of  combustion  products  and  progressively  increased  dilution  of  the  hot 
products  with  cooler  air. 

The  types  of  analyses  described  above  will  be  incorporated  in  a model  which 
will  attempt  to  define  rates  of  heat  and  mass  transfer  to  objects  exposed  to  the 
SPFE.  Combined  with  a more  thorough  knowledge  of  the  thermochemistry  of  the 
combustion  region  and  chemical  reactions  which  may  be  important,  an  increased 
understanding  of  RTG  containment  failure  mechanisms  will  be  gained. 


12.  Glass,  I.,  Metal  Combustion  Processes.  AEL  Report  473a,  Princeton  University, 
Trenton,  N.J.,  May  I960. 

13.  Price,  E.  W.,  Investigation  of  the  Behavior  of  Aluminum  in  Combustion  of 
Solid  Rocket  Propellants.  Georgia  Institute  of  Technology,  March  1975. 

14.  SNAP  29  Solid  Propellant  Fire  Test,  INSO-2062-7-9,  Teledyne  Isotopes, 

Nuclear  Systems  Division,  Timonium,  MD,  July  1969 

15.  Baker,  F.  L.,  Solid  Propellant  Burn  Tests,  SC-DR-71-0084,  Sandia  Laboratories, 
Albuquerque,  New  Mexico,  March  1971. 
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5.  SOLID  ROCKET  MOTOR  (SRM)  IMPACT  ANALYSIS 

A difficult  and  critical  problem  Is  characterizing  the  response  of  a Solid 
Rocket  Motor  (SRM)  to  Impact  at  less  than  terminal  velocity.  The  fracture  and 
subsequent  propellant  dispersion  controls  the  duration  and  configuration  of  a 
fuel  sphere  assembly's  (FSA)  exposure  to  a harsh  thermochemical  environment 
created  by  the  solid  propellant  fire. 

The  AFWL  has  undertaken  an  analytical  and  experimental  program  to  charac- 
terize the  SRM  Impact  conditions  necessary  for  fracture  of  the  D6Ac  steel  casing 
resulting  In  release  of  potentially  very  large  (s  ft^)  pieces  of  burning  solid 
propellant.  This  program  Is  composed  of  three  groups  of  Impact  tests:  bare 
propellant  Impact  tests,  scaled  SRM  Impact  tests,  and  a full-scale  SRM  segment 
test. 

The  bare  propellant  Impact  tests  recently  completed  tested  the  Ignition  sen- 
sitivity of  the  Titan  III  UTP-3001  solid  propellant  and  the  ability  to  analyti- 
cally predict  the  Impact  pressures  and  propellant  deformations  (ref.  16).  A 
series  of  three  tests  was  conducted  utilizing  1 to  2 foot  cubes  of  solid  pro- 
pellant and  Impact  velocities  of  79  to  118  fps.  The  dimensions,  masses,  and 
Impact  velocities  were  shown  in  table  1.  Perhaps  the  most  significant  result  of 
the  bare  propellant  tests  was  the  ability  of  the  finite  element  computer  code 
HONDO  (ref.  17)  to  predict  stresses  and  deformations  In  the  solid  propellant. 

This  code  has  been  prepared  for  use  In  the  SRM  Impact  response  analysis  based 
upon  the  results  of  the  bare  propellant  Impact  tests. 

Table  1 

DIMENSIONS,  MASSES,  AND  IMPACT  VELOCITIES 
OF  BARE  UTP-3001  SOLID  PROPELLANT 


Propellant  Dimensions 

Mass 

Impact  Velocity 

(cm) 

(kg) 

(m/sec) 

30.5  X 30.5  X 30.5 

50.2 

24.1 

30.5  X 30.5  X 30.5 

66.8 

24.4 

61.0  X 61.0  X 61.0 

401.8 

36.0 

16.  Crawford,  M.  L>.  Titan  III  Solid  Rocket  Motor  Impact  Structural  Response, 
Phase  I:  Bare  Propellant  Impact  Tests.  AFWL  TR-77-87.  1977 

17.  Key,  S.  W.,  HONDO-A  FInUe  Element  Computer  Program  for  the  Large  Deformation 
Dynamic  Response  of  Axl symmetric  Solids,  SLA-74-0039.  Sandia  Laboratories. 
Albuquerque,  NM,  April  1974 
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The  next  phase  will  be  the  impact  of  a series  of  scaled  SRM  models.  The 
dimensions  of  the  models  will  be  based  on  a 1/6  linear  scale,  and  will  include 
the  use  of  an  inert  solid  propellant  simulant.  Five  single  segments  will  be 
impacted  at  various  velocities,  orientations,  and  impacting  media,  followed  by 
a full  five  segment  scaled  SRM  impacted  at  the  conditions  deemed  to  be  the  most 
probable  for  an  actual  launch  abort.  The  results  of  these  tests  are  intended  to 
show  the  structural  integrity  of  the  scaled  motor  casings  after  impact.  The  HONDO 
will  be  used  to  simulate  the  impacts,  and  its  ability  to  predict  fracture  of  the 
motor  casings  will  be  evaluated. 

The  final  phase  of  the  program  will  be  the  impact  of  an  actual  Titan  III-C 
SRM  segment.  The  impact  conditions  will  be  determined  based  on  the  results  of 
the  initial  phases  of  the  program.  The  results  of  this  full-scale  test  will 
provide  overpressure  as  well  as  fragmentation  and  dispersion  data. 

The  proposed  combined  analytical  and  experimental  program  will  provide  crit- 
ical SRM  fragmentation  data  which  is  presently  unavailable. 
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SECTION  IV 

AFWL  REVIEW  FOR  THE  LINCOLN  EXPERIMENTAL  SATELLITES  8 AND  9 (LES  8/9) 

The  typical  use  of  the  preceding  analytical  techniques  and  environment  defini- 
tions were  demonstrated  in  independent  Air  Force  assessment  of  LES  8/9.  The 
event/consequence  trees  (modified  fault  trees)  were  used  with  FMEA  data  to  deter- 
mine the  occurrence  probabilities  of  each  potential  accident.  The  FMEA  data 
were  modified  based  on  a historical  missile  reliability  study  (ref.  18)  to  de- 
velop credible  accident  probabilities  consistent  with  available  NASA  and  DOD 
launch  experience.  The  event  trees  traced  the  expected  sequence  of  events 
leading  to  accidents  (with  or  without  fuel  release)  and  subsequent  system  re- 
sponse. The  system  response  analysis  was  based  on  a nominal  model  of  RTG  integ- 
rity resulting  from  the  safety  tests  and  available  analytical  capability  dis- 
cussed in  the  preceding  section. 

For  the  AFWL  analysis,  the  launch  sequence  was  divided  into  10  parts  based 
on  the  times  into  launch  yielding  significant  variations  in  missile  systems 
response  or  potential  accident  environments.  A typical  accident  sequence  tree, 
“Early  Ascent  1,  Phase  2A"  is  shown  in  figures  4a  and  4b.  The  5-to  12-second 
time  phase,  with  destruct  action  malfunction  and  full  vehicle  impact,  is  rep- 
resentative of  the  logic  development  used  in  the  entire  LES  8/9  analyses.  This 
portion  of  the  launch  sequence  is  significant  because  there  is  no  down  range 
velocity  component  with  potential  launch  pad  impact.  Following  the  paths  shown, 
specifically  structural  failures  and  incorrect  staging,  the  FMEA  data  and 
component  analysis  provided  the  conditional  probabilities  shown  (Pstructural 
= 0.5898  and  = 0.0053).  Next  in  the  sequence  is  the  Range  Safety 

Officer's  (RSO)  opportunity  and  ability  to  utilize  CSDS  (command  de^ruct).  This 
probability  is  an  estimate  baseo  on  tne  time  required  for  RSO  response  with 

system  response  requirements.  Assuming  the  next  action  is  destruct  failure 
(based  on  Eastern  Test  Range  data,  P = 0.05),  structural  analysis  indicated  the 
full  vehicle  or  major  portion  of  the  vehicle  (Titan  IIIC)  would  impact.  The 
consequences  of  the  impact  are  based  on  an  analysis  of  numerous  subsystem  (fuel 

18.  Thnrntnn  M A.  LAUNCH,  A Computer  Code  for  Determining  Launch  Vehicle 
Rel iabilhy,  AFWL-TR-f7-126,  kirtland  AFB,'1ew  Mexico;  T977. 


] 

1 


17 


AFWL-TR-77-104 


assemblies)  impact  tests  performed  and  analyzed  by  Los  Alamos  Scientific 
Laboratory  (LASL).  The  land  description  was  based  on  Kennedy  Space  Center  (KSC) 
land  use  studies.  The  orientation  of  the  RTG  was  largely  engineering  judgment 
utilizing  cylinder  trip  studies  and  RTG  impact  response  in  each  situation.  The 
conditional  probabilities  also  include  a factor  for  the  longer  time  frame  re- 
sulting in  higher  velocity  impacts  with  more  severe  consequences.  At  this  point, 
no  further  analysis  was  performed  unless  fuel  release  was  determined.  If  fuel 
release  was  expected,  the  environments  causing  release  were  analyzed  using  LASL 
experimental  data  and  analyses  wherever  applicable.  Table  2 shows  the  prob- 
ability summaries  for  each  phase  with  the  historical  corrections.  Each  of  the 
events  leading  to  fuel  release  were  classed  according  to  the  appropriate 
"nominal"  accident.  The  nominal  accidents  were  developed  from  the  safety  test 
results  previously  discussed.  Table  3 summarizes  these  results  with  totals  for 
the  four  MHW  RTG  aboard  LES  8/9.  A typical  source  term  summary  (specifically 
for  LES  8/9  environments)  is  shown  in  table  4.  The  fuel  releases  developed  in 
the  AFWL  independent  assessment  are  shown  with  historical  release  probabilities 
In  table  5,  "LES  8/9  Source  Terms."  This  analysis  was  presented  to  the  INSRP 
and  its  coordinators  along  with  NASA  and  ERDA  prepared  independent  analyses. 

The  combined  independent  assessments  and  RTG  contractor  Safety  Analysis  Report 
were  reviewed  by  the  Interagency  Coordinators  who  in  turn  prepared  the  Safety 
Evaluation  Report  (SER).  The  numerous  different  analyses  and  expected  con- 
sequences are  studied  and  utilized  by  the  panel  to  prepare  the  most  representa- 
tive SER  for  presentation  to  the  National  Security  Council  for  launch  approval. 
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Table  4 


AFWL  MHW  SOURCE  TERM  SUMMARY 
(mCi/FSA) 


Accident 

Environment 

Impact 

Solid  F 

Normal  Operation 

> 200  fps 

0.5 

10 

Powered 

1.0 

N/A 

Impact 

Large 

8.0 

380 

Medium 

2.0 

190 

Small 

0.04 

4 

Single  Proximity 

(PISA  Only) 

400 

Double  Proximity  (PISA  or  FSA) 

400 

Table  5 

LES  8,  9 SOURCE  TERMS 

Accident  Probability  Vapor  (mCi)  Particulates  (tnCi) 


1 

2.2  E-8 

800 

2 

1.2  E-5 

168 

3 

1.0  E-7 

400 

1 

1.8  E-8 

8000 

4A 

3.6  E-8 

8000 

30 

48 

5.5  E-7 

1000 

35 

4C 

4.4  E-4 

38 

1 

1.6  E-11 

800 

5A 

2.3  E-11 

8000 

1 

58 

4.5  E-11 

1000 

7 

5C 

1.1  E-6 

10 

2 

2.2  E-6 

168 

3 

4.1  E-8 

4000 

5C 

3.2  E-5 

10 

2 

3.3  E-7 

168 

3 

4.9  E-9 

400 

5C 

1.5  E-7 

10 

5C 

2.4  E-7 

10 

5C 

1.4  E-4 

10 

5C 

1.7  E-5 

10 

5C 

1.9  E-4 

10 
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SECTION  V 

ENVIRONMENTAL  STATEMENT 

The  National  Environmental  Policy  Act  of  1969  (NEPA)  and  other  legislation 
declared  a national  policy  that  encourages,  among  other  things,  productive  and 
enjoyable  harmony  between  man  and  his  environment,  promotes  efforts  that  will 
prevent  or  eliminate  damage  to  the  environment  and  biosphere,  and  that  will 
stimulate  the  health  and  welfare  of  man.  Guidelines  and  directives  for  the 
production  of  Environmental  Statements  (ES)  are  also  called  forth.  The  APR  19-2 
"establishes  policies,  assigns  responsibilities,  and  provides  guidance  for  the 
preparation  of  environmental  assessments  and  statements."  The  key  is  the  direc- 
tion to  assess  the  environmental  consequences  of  any  proposed  action  at  the 
earliest  stage  practicable,  and  to  use  these  assessments  in  the  decision  making 
process. 

Guidelines  of  the  Council  of  Environmental  Quality  (CEQ)  and  the  DOD  have 
dictated  that  for  attions  such  as  the  Air  Force  launch  of  a space  nuclear  power 
source,  the  following  actions  are  required; 

a.  An  environmental  assessment  be  prepared  prior  to  Defense  System 
Acquisition  Review  Council  (DSARC)  I. 

b.  A candidate  environmental  statement  be  prepared  prior  to  DSARC  II. 

c.  A final  environmental  statement  be  prepared  at  least  30  days  prior 
to  final  action. 

Figure  5 is  a flow  chart,  taken  from  AFR  19-2,  for  the  processing  of  a typ- 
ical ES.  It  is  worth  noting  that  since  the  ES  is  prepared  very  early  in  the 
system  development  process,  complete  mission  and  design  data  are  not  available 
and  the  analysis  performed  does  not  have  the  depth  or  breadth  of  that  performed 
for  the  INSRP.  It  is  certainly  not  a substitute  for  the  INSRP  process,  but  can 
be  a useful  adjunct. 

The  AFWL  prepared  the  ES  for  the  LES  8/9  launch  (ref.  19),  and  the  format 
of  this  statement  is  outlined  to  show  the  areas  covered.  As  would  be  expected. 


19.  Final  Environmental  Statement,  Lincoln  Experimental  Satellites  8 and  9 
(LES  8/9)  Program,  USAF,  December  1975. 
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the  statement  led  off  with  a relatively  complete  program  mission  description. 

The  probable  environmental  Impact  of  the  mission  was  then  addressed  In  detail. 
Specifically,  the  following  scenarios  and  effects  were  Included. 

a.  Normal  launch  and  mission 

b.  Aborts  and  accidents 

c.  Ultimate  reentry 

d.  Socioeconomic  effects 

e.  Operational  system 

Unavoidable  adverse  environmental  effects  and  the  Irreversible  and  unretrlev 
able  commitments  of  resources  were  addressed  In  separate  chapters.  The  ES  also 
contained  a comprehensive  discussion  of  alternative  mission  profiles.  Including 
the  consequences  of  a "no  mission"  decision.  Various  appendixes,  dealing  with 
technical  discussions  and  summaries,  were  Included  for  completeness.  It  Is 
worth  noting  that  nine  Government  agencies  formally  commented  on  the  ES  during 
Its  preparation.  All  comments  received  were  Included  as  appendixes  to  the  final 
"Statement.  The  agencies  were: 

a.  U.  S.  Department  of  Transportation 

b.  NASA 

c.  U.S.  Department  of  Commerce 

d.  State  of  Florida 

e.  U.  S.  Department  of  Health,  Education,  and  Welfare 

f.  U.  S.  Department  of  the  Interior 

g.  The  Nuclear  Regulatory  Commission 

h.  ERDA 

1.  The  Environmental  Protection  Agency 
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